Privacy policy

Who is responsible for your data

This policy applies to popesko.com. Personal data controller:

What information we use

For orders: name, email, phone, delivery and billing addresses, products, sizes, amounts and payment status. For an agreed bank-transfer refund: IBAN and account-holder name. Required fields are marked; without the necessary details we cannot fulfil the order.

For an account, wishlist or enquiry: the information you provide, saved products and correspondence. Technical information such as IP address, browser and website events may be processed to operate and secure the service. Data comes from you, your device and providers confirming payment or delivery.

Why we process it

Contract performance or steps you request before purchase: orders, delivery, payment, accounts and returns (GDPR Article 6(1)(b)). Legal obligations: applicable accounting, tax and consumer requirements (Article 6(1)(c)).

Consent: newsletters and requested stock alerts (Article 6(1)(a)). Legitimate interests: website security, preventing abuse and defending legal claims, balanced against your rights (Article 6(1)(f)). Refusing marketing does not prevent a purchase or necessary order emails.

Newsletters and stock alerts

Newsletter records include email, language, consent and signup date. Withdraw consent at any time by emailing us below or using the unsubscribe link when included in the message.

Stock alerts store email, the specific product or size, language and confirmation details. Confirmation links expire after 48 hours; confirmed requests expire after 365 days. A request is removed on cancellation or successful handoff of the alert for sending. Expired records are cleared by the website’s scheduled cleanup. A stock alert does not automatically subscribe you to the newsletter.

Cookies and preferences

The site uses technologies for the cart, account login and requested features. The popesko_lang cookie remembers your BG/EN language choice for up to one year. Wishlists are handled by the active wishlist feature and may be associated with your browser or account.

Optional analytics and advertising technologies require prior consent where the law requires it. Use the cookie banner settings, where available, to review and change your choices. You can also delete cookies in your browser; this may reset your cart, login or preferences.

Who receives information

Necessary information is provided to hosting and technical-support providers, email services, the selected courier, payment providers for your chosen method and accounting services. Competent authorities may receive information where legally justified. Sharing is limited to the purpose of the relevant service.

If a service involves transfer outside the European Economic Area, an applicable mechanism is required, such as an adequacy decision or standard contractual clauses with necessary supplementary measures. Contact us for details of recipients, processing locations and a copy of applicable safeguards.

How long information is kept

Orders and accounting documents are retained for applicable legal periods, depending on the type of document and obligation. Correspondence is kept to resolve the enquiry and for the necessary period to handle claims. Account information is kept while the service is used or until an erasure request, apart from records that must be retained.

Marketing data is used until consent is withdrawn; a minimal record may be retained to demonstrate consent or honour an opt-out. Stock-alert periods are set out above. Backups and technical logs follow the relevant service’s cycle and should not be retained beyond what is needed for recovery, security and legal obligations.

Your rights

Subject to the applicable conditions, you may request access, a copy, correction, erasure, restriction and portability. You may object to legitimate-interest processing and at any time to direct marketing. Withdrawal of consent does not affect earlier lawful processing. Erasure does not override statutory retention duties.

Email us from the address associated with your order or account. We may request limited information to verify identity where needed. We respond without undue delay, normally within one month. Where a permitted extension of up to two further months is needed, we will explain it within the first month. Requests are generally free.

Security and automated features

Limit free-text information to what is needed for your enquiry. Do not email passwords, banking credentials or full payment-card details. Automatic order emails and stock notifications do not themselves constitute decisions with legal or similarly significant effects. Contact us with questions about automated processing.

Questions and complaints

You may complain to Bulgaria’s Commission for Personal Data Protection (CPDP), or the supervisory authority where you habitually reside, work or where the alleged infringement occurred. You do not have to contact us first.